Overview of incoming advisories.
2186 results found
A HTTP request smuggling vulnerability (CL.TE desynchronization) exists in Mongoose, an embedded web server and network library, prior to version 7.22. A remote unauthenticated attacker can craft an HTTP request containing both Content-Length and Transfer-Encoding: chunked headers. The mg_http_parse() and http_cb() functions in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy may interpret request boundaries differently. This mismatch allows an attacker to inject smuggled requests that can access or modify resources belonging to other users. The vulnerability requires no authentication to exploit and can lead to unauthorized data access or modification in another user's context. The issue has been patched in Mongoose version 7.22, with a fix available via the official GitHub repository.
View original advisory →A vulnerability in hank-ai/darknet involves unchecked 32-bit integer arithmetic when sizing convolutional layer weight and output heap buffers from .cfg configuration files. The computation of l.nweights and l.outputs can overflow when dimension products exceed INT_MAX, causing undersized memory allocations. An attacker can craft a malicious .cfg file where dimensions like width/height of 256 with 65536 filters produce a 2^32 product wrapping to zero. The forward_convolutional_layer function then re-derives GEMM dimensions with a different operand order, causing reads and writes beyond the undersized buffer. No valid .weights file is required, only the crafted .cfg file. A proof-of-concept demonstrated heap buffer overflow reads in gemm_nn_fast under AddressSanitizer and glibc allocator metadata corruption in release builds, confirming out-of-bounds write capability.
View original advisory →CVE-2026-65816 is a vulnerability in Microsoft Azure Arc involving the use of an incorrectly-resolved name or reference. The flaw allows an unauthorized attacker to elevate privileges over a network without requiring prior authentication. This type of vulnerability is categorized under improper name/reference resolution, which can be exploited remotely. The affected product is Azure Arc, Microsoft's hybrid and multi-cloud management platform. The vulnerability has been assigned a high severity rating. Microsoft has published an advisory via the Microsoft Security Response Center (MSRC). No additional technical details or proof-of-concept information are currently available in the article. Organizations using Azure Arc should monitor for patches and apply mitigations as soon as they become available.
View original advisory →A command injection vulnerability has been identified in Tenda CH22 firmware version 1.0.0.1. The vulnerability exists in the formcreateFileName function within the /goform/formcreateFileName endpoint. Attackers can manipulate the fileNameMit argument to inject arbitrary commands. The attack can be launched remotely without requiring physical access to the device. A public exploit has already been disclosed, increasing the risk of active exploitation. This affects Tenda CH22 routers, which are network infrastructure devices. The vulnerability is classified as high severity due to its remote exploitability and public disclosure. No patch or mitigation details are mentioned in the article.
View original advisory →A vulnerability in Mongoose, an embedded web server and network library, allows remote unauthenticated attackers to perform HTTP request smuggling against HTTP/1.0 reverse-proxy deployments. The flaw exists in the http_cb() function in src/http.c, where hm.proto.len is tested with an impossible greater-than-eight condition, causing is_http_1_0 to never be set. This logic error allows Mongoose to process chunked Transfer-Encoding that an HTTP/1.0 proxy would normally ignore. By sending a crafted request with conflicting framing, an attacker can exploit this discrepancy to smuggle requests. The impact includes unauthorized access and unauthorized state changes on the affected system. The vulnerability affects all versions of Mongoose prior to 7.22. A fix has been released in version 7.22 along with an associated GitHub commit and security advisory.
View original advisory →CVE-2026-68789 describes an SQL injection vulnerability in Microsoft Azure SQL Database. The flaw involves improper neutralization of special elements in SQL commands, allowing an authorized attacker to elevate privileges over a network. The vulnerability is classified as a privilege escalation issue exploitable remotely. It requires the attacker to already have some level of authorization before exploitation. Microsoft has published an advisory via the Microsoft Security Response Center (MSRC). The vulnerability is tracked in the National Vulnerability Database (NVD) at NIST. Given the cloud database context, the potential impact on sensitive data and infrastructure is significant.
View original advisory →A Cross-Site Request Forgery (CSRF) vulnerability has been identified in HashThemes Easy Elementor Addons, a WordPress plugin. The vulnerability affects all versions of the plugin up to and including 2.3.7. Exploitation of this flaw could allow an attacker to perform unauthorized actions on behalf of authenticated users by tricking them into visiting a malicious page. The issue is tracked as CVE-2026-28164 and has been documented by both the NVD and Patchstack. No patch version lower bound is specified, indicating all prior releases may be affected. WordPress site administrators using this plugin are advised to update to a patched version as soon as one becomes available. The vulnerability is classified under CWE for CSRF attacks, which can lead to privilege escalation or data manipulation depending on the plugin's functionality.
View original advisory →CVE-2026-61704 affects the Link Preview JS library (versions prior to 4.0.4), which is used to extract web link metadata. The vulnerability exists in the resolveDNSHost mitigation within index.ts, where the code validates one resolved IP address but subsequently fetches the original hostname. This mismatch creates a DNS rebinding condition that allows an attacker-controlled DNS server to return a public IP during validation and a loopback or internal IP during the actual fetch request. The flaw effectively bypasses the library's built-in SSRF (Server-Side Request Forgery) protection, potentially exposing internal HTTP resources. Redirect handling is also affected by the same validation-to-fetch mismatch. The issue has been patched in version 4.0.4, with fixes available via two separate commits on GitHub.
View original advisory →A SQL injection vulnerability has been identified in code-projects Simple Inventory System version 1.0. The flaw exists in the /delete.php file, where the 'ID' argument is improperly handled, allowing an attacker to manipulate SQL queries. The attack can be launched remotely without requiring physical access to the target system. A public exploit has been disclosed, increasing the risk of active exploitation. The vulnerability affects the delete functionality of the inventory management application. No authentication details are specified, suggesting it may be exploitable without credentials. The issue has been assigned CVE-2026-76990 and is tracked in the NVD and VulDB databases. Administrators using this software are advised to apply patches or mitigations immediately. The disclosure includes a security advisory hosted on GitHub detailing the vulnerability.
View original advisory →CVE-2026-71485 affects Centrifugo, an open-source scalable real-time messaging server, in versions prior to 6.9.0. The vulnerability allows remote clients to spoof trusted headers such as x-trusted-user by injecting values through the client-controlled protocol.ConnectRequest.headers map. These spoofed headers are propagated through multiple internal paths including HTTP proxy, gRPC proxy, and unidirectional gRPC transport. The flaw can be exploited during connect, refresh, subscribe, publish, RPC, and related proxy calls when backend systems rely on these headers for authentication or authorization decisions. The unidirectional gRPC transport is particularly affected as it has no transport-level HTTP header to override the emulated value. This represents a significant authentication bypass risk for deployments relying on header-based trust models. The issue has been patched in Centrifugo version 6.9.0.
View original advisory →A missing authorization check in the Mailu admin REST API (prior to version 2024.06.52) allows unauthenticated attackers to remove IP restrictions or modify comment fields on existing user tokens. The vulnerability is exploitable without any authentication, provided the REST API feature is enabled. Mailu is a mail server solution distributed as a set of Docker images. The flaw could allow attackers to bypass IP-based access controls on user tokens, potentially escalating access. A patch is available in Mailu version 2024.06.52. As a workaround, administrators are advised to disable the REST API entirely. The vulnerability has been assigned CVE-2026-49217 and is tracked in the NVD as well as a GitHub Security Advisory.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the file /fos/admin/view_order.php, where manipulation of the 'ID' argument leads to SQL injection. The vulnerability can be exploited remotely without requiring physical access to the target system. A public exploit has already been released, increasing the risk of active exploitation. The affected component involves an unknown function within the admin panel of the application. This vulnerability poses a significant risk to systems running this software, as attackers could potentially access, modify, or delete database contents. The public availability of the exploit makes prompt patching or mitigation critical for affected deployments.
View original advisory →The @cgauge/yaml npm package contains a critical arbitrary code execution vulnerability tracked as CVE-2026-76833. The vulnerability stems from a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application that parses untrusted YAML input using this library is exposed to full Node.js runtime authority. This includes access to environment variables, filesystem read/write operations, network access, and subprocess execution. There is no safe-mode alternative or opt-out mechanism available to mitigate the risk within the library itself. The vulnerability is classified as high severity and affects all users of the package who handle untrusted YAML input.
View original advisory →A stack-based buffer overflow vulnerability has been identified in Comfast CF-N1-S firmware version 2.6.0.1. The flaw exists in the function sub_44B438 within the SSID Configuration component, accessible via the CGI endpoint /cgi-bin/mbox-config?method=SET§ion=ptest_ssid. An attacker can manipulate the 'ssid' argument to trigger the overflow remotely without authentication. The vulnerability is classified as remotely exploitable, increasing the risk of widespread exploitation. A public exploit has already been released, making this an active threat to devices running the affected firmware. Comfast CF-N1-S is a wireless networking device, placing this vulnerability in the IoT and network infrastructure space. Organizations or individuals using this device should apply patches or mitigations immediately. The vulnerability has been documented on NVD, VulDB, and GitHub, with multiple reference links available.
View original advisory →CVE-2026-16926 affects IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability allows a remote attacker to overwrite arbitrary files on the affected system. The root cause is improper neutralization of special elements in input, a class of vulnerability related to injection flaws. Successful exploitation could lead to data integrity loss, system instability, or further compromise. The vulnerability is remotely exploitable without requiring local access. IBM has published a support advisory at ibm.com detailing the issue. The CVE has been assigned a High criticality rating. No additional exploitation details or active threat actor involvement have been disclosed at this time.
CVE-2026-69183 affects Monkeytype version 26.26.0 and earlier, where the backend rate-limit key generator improperly trusts client-controlled HTTP headers (cf-connecting-ip and x-forwarded-for) over the proxy-derived req.ip value. An unauthenticated attacker can rotate these headers to generate new rate-limit buckets per request, effectively bypassing all rate limiting protections including rootRateLimiter and badAuthRateLimiter. This allows abuse of public endpoints such as POST /users/forgotPasswordEmail and verificationEmail, enabling mail bombing of registered users and exhaustion of Firebase or SMTP quotas. The vulnerability also undermines brute-force protection mechanisms, posing a resource exhaustion risk. Exploitation via x-forwarded-for is broadly applicable, while cf-connecting-ip exploitability depends on deployment topology. No fixed version was available at the time of review.
View original advisory →A vulnerability in libgit2 prior to versions 1.8.6 and 1.9.5 allows a malicious Git server to crash a client via a heap out-of-bounds read. The flaw resides in the set_data function in src/libgit2/transports/smart_pkt.c, where a fixed-size strncmp is performed without verifying that the smart-protocol pkt-line capability buffer contains at least 14 bytes. An attacker-controlled Git server can craft a pkt-line that causes format_str to advance beyond the buffer boundary, leading to an integer underflow in a subsequent memchr length calculation. This results in a heap out-of-bounds walk that can crash the client during the first refs-advertisement packet. The vulnerability affects clients using HTTP, HTTPS, SSH, or the Git protocol. Fixes are available in libgit2 versions 1.8.6 and 1.9.5.
View original advisory →CVE-2026-73040 describes a path traversal vulnerability in Dockge, a Docker Compose stack manager. The flaw exists because stack name validation is only enforced on the write path (via save()), but not on read/delete operations. Authenticated users can supply traversal sequences as a stack name to access files outside the managed stacks directory. This allows disclosure of .env and Compose file secrets, and deletion of arbitrary directories containing valid Compose files. Dockge commonly runs as root with Docker socket access, expanding the attack surface to the entire host. Instances with disableAuth enabled are exploitable without any authentication. Affected code paths are in backend/stack.ts and backend/agent-socket-handlers/docker-socket-handler.ts.
View original advisory →CVE-2026-72848 describes a Server-Side Request Forgery (SSRF) vulnerability in the LangChain Community library's SitemapLoader component. The restrict_to_same_domain parameter, intended to confine outbound HTTP requests to the original domain, is only enforced for leaf URL entries and not for nested sitemap index entries. An attacker who can influence or control an ingested sitemap can insert nested sitemap entries pointing to internal, loopback, or link-local addresses. These URLs are passed directly to WebBaseLoader.scrape_all via aiohttp GET requests without any domain or IP range validation. The fetched internal content is then parsed and returned as Documents to the caller, resulting in disclosure of internal service responses. This vulnerability affects applications using langchain-community's SitemapLoader with restrict_to_same_domain=True, providing a false sense of security. Remediation requires applying domain and private IP checks to nested sitemap element processing in sitemap.py.
View original advisory →A vulnerability in django CMS prior to version 5.0.8 allows a staff user with plugin-change permission to create a parent_id cycle in the plugin tree via the move_plugin endpoint in cms/admin/placeholderadmin.py. The endpoint accepts an attacker-controlled plugin_parent value without validating against the plugin's own identifier or descendant identifiers. The recursive CTE queries _get_descendants_cte and _get_ancestors_cte in cms/models/pluginmodel.py lack cycle guards, enabling indefinite recursion or database recursion limit exhaustion. Exploitation can corrupt the plugin tree and consume request workers, effectively causing a denial of service. The vulnerability requires a staff account with CMS_PERMISSION and plugin-change rights, limiting but not eliminating risk. The issue has been patched in django CMS version 5.0.8.
View original advisory →